hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. https://nvd.nist.gov/vuln/detail/CVE-2018-20126